[PATCH] Swapped bogus_error_messages for bogus_error_responses
Michael Palmiotto
mpalmiotto at tresys.com
Tue Jul 17 01:08:11 UTC 2012
________________________________________
>From 0620e2436f830a57017414a21bffaf23ba2fbb2d Mon Sep 17 00:00:00 2001
>From: Shawn Wells <shawn at redhat.com><mailto:shawn at redhat.com>
>Date: Mon, 16 Jul 2012 02:13:41 -0400
>Subject: [PATCH] Swapped bogus_error_messages for bogus_error_responses
>https://fedorahosted.org/pipermail/scap-security-guide/2012-July/001092.html
>---
>...l_net_ipv4_icmp_ignore_bogus_error_messages.xml | 39 -------------------- >RHEL6/input/profiles/common.xml | 2 +-
>RHEL6/input/system/network/kernel.xml | 2 +-
> 3 files changed, 2 insertions(+), 41 deletions(-)
> delete mode 100644 RHEL6/input/checks/sysctl_net_ipv4_icmp_ignore_bogus_error_messages.xml
>diff --git a/RHEL6/input/checks/sysctl_net_ipv4_icmp_ignore_bogus_error_messages.xml >b/RHEL6/input/checks/sysctl_net_ipv4_icmp_ignore_bogus_error_messages.xml
>deleted file mode 100644
>index b15444b..0000000
>--- a/RHEL6/input/checks/sysctl_net_ipv4_icmp_ignore_bogus_error_messages.xml
>+++ /dev/null
>@@ -1,39 +0,0 @@
>-<def-group>
>- <definition class="compliance"
>- id="sysctl_net_ipv4_icmp_ignore_bogus_error_messages" version="1">
>- <metadata>
>- <title>Network Parameters for Hosts and Routers</title>
>- <affected family="unix">
>- <platform>Red Hat Enterprise Linux 6</platform>
>- </affected>
>- <reference ref_id="CCE-4133-5" source="CCE" />
>- <description>Ignoring bogus ICMP responses to broadcasts
>- should be enabled or disabled as appropriate.</description>
>- </metadata>
>- <criteria>
>- <criterion test_ref="test_20123" />
>- </criteria>
>- </definition>
>- <ind:textfilecontent54_test check="all"
>- check_existence="all_exist"
>- comment="Tests the value of the ^[\s]*net\.ipv4\.icmp_ignore_bogus_error_messages[\s]*=([\s]*) expression in the /etc/sysctl.conf file"
>- id="test_20123" version="1">
>- <ind:object object_ref="obj_20123" />
>- <ind:state state_ref="state_20123" />
>- </ind:textfilecontent54_test>
>- <ind:textfilecontent54_state id="state_20123"
>- version="1">
>- <ind:subexpression operation="equals" var_check="all"
>- var_ref="var_20123" />
>- </ind:textfilecontent54_state>
>- <external_variable comment="External variable for definition 20123"
>- datatype="string" id="var_20123"
>- version="1" />
>- <ind:textfilecontent54_object id="obj_20123"
>- version="2">
>- <ind:path>/etc</ind:path>
>- <ind:filename>sysctl.conf</ind:filename>
>- <ind:pattern operation="pattern match">^[\s]*net\.ipv4\.icmp_ignore_bogus_error_responses[\s]*=([\s]*)</ind:pattern>
>- <ind:instance datatype="int">1</ind:instance>
>- </ind:textfilecontent54_object>
>-</def-group>
>diff --git a/RHEL6/input/profiles/common.xml b/RHEL6/input/profiles/common.xml
>index 1b188da..b57ee15 100644
>--- a/RHEL6/input/profiles/common.xml
>+++ b/RHEL6/input/profiles/common.xml
>@@ -59,7 +59,7 @@
><select idref="set_sysctl_net_ipv4_conf_default_accept_source_route" selected="true"/>
> <select idref="set_sysctl_net_ipv4_conf_default_secure_redirects" selected="true"/>
> <select idref="set_sysctl_net_ipv4_icmp_echo_ignore_broadcasts" selected="true"/>
>-<select idref="set_sysctl_net_ipv4_icmp_ignore_bogus_error_messages" selected="true"/>
>+<select idref="set_sysctl_net_ipv4_icmp_ignore_bogus_error_responses" selected="true"/>
> <select idref="set_sysctl_net_ipv4_tcp_syncookies" selected="true"/>
> <select idref="set_sysctl_net_ipv4_conf_all_rp_filter" selected="true"/>
> <select idref="set_sysctl_net_ipv4_conf_default_rp_filter" selected="true"/>
>diff --git a/RHEL6/input/system/network/kernel.xml b/RHEL6/input/system/network/kernel.xml
>index 03be8ec..63bb1f5 100644
>--- a/RHEL6/input/system/network/kernel.xml
>+++ b/RHEL6/input/system/network/kernel.xml
>@@ -293,7 +293,7 @@ addresses makes the system slightly more difficult to enumerate on the network.
> <Rule id="set_sysctl_net_ipv4_icmp_ignore_bogus_error_responses">
>-<title>Enable Kernel Parameter to Ignore Bogus ICMP Error Messages</title>
>+<title>Enable Kernel Parameter to Ignore Bogus ICMP Error Responses</title>
> <description>
> <sysctl-desc-macro sysctl="net.ipv4.icmp_ignore_bogus_error_responses" value="1" />
> </description>
Looks good. I appreciate the proper diagnosis. ACK
-Mike
More information about the scap-security-guide
mailing list